Base multi-label classifiers:  We adopt ASL [1]} to train the base multi-label classifiers on the three benchmark datasets. In particular, ASL leverages an asymmetric loss to solve the positive-negative imbalance issue (an image has a few positive labels while has many negative labels on average) in multi-label classification, and achieves state-of-the-art performance on the three benchmark datasets. Suppose \(q_j\)  is the probability that a base multi-label classifier predicts label \(j\)  \((j=1,2,\cdots , c)\)  for a training input. Moreover, we let \(y_j\)  be 1 (or 0) if the label \(j\)  is (or is not) a ground truth label of the training input. The loss of ASL [2] is as follows: \(L_{ASL}=\sum _{j=1}^{c} -y_{j} L_{j+}-(1-y_{j}) L_{j-}\) , where \(L_{j+}=(1-q_{j})^{\gamma _{+}} \log (q_{j})\)  and \(L_{j-}=\left(\max (q_{j}-m,0)\right)^{\gamma _{-}} \log \left(1-\max (q_{j}-m,0)\right)\) . Note that \(\gamma _{+}\) , \(\gamma _{-}\) , and \(m\)  are hyperparameters. Following [1]}, we set training hyperameters \(\gamma _{+}=0, \gamma _{-}=4\) , and \(m=0.05\) . We train the classifier using Adam optimizer, using learning rate \(10^{-3}\)  and batch size 32. We adopt the public implementation of ASLhttps://github.com/Alibaba-MIIL/ASL in our experiments.  Similar to previous work [3]} on randomized smoothing based multi-class classification, we add isotropic Gaussian noise to the training data when we train our base multi-label classifiers. In particular, given a batch of training images, we add isotropic Gaussian noise to each of them, and then we use the noisy training images to update the base multi-label classifier. Our experimental results indicate that such training method can substantially improve the robustness of our MultiGuard (please refer to Figure REF  in supplementary material).
<FIGURE>